Information controller, information control system, and information control method

Patent metadata

Field	Value
Publication number	US-9874869-B2
Application number	US-201314777609-A
Country	US
Kind code	B2
Filing date	Mar 29, 2013
Priority date	Mar 29, 2013
Publication date	Jan 23, 2018
Grant date	Jan 23, 2018

Abstract

The present invention detects abnormality in a control network in which a normal pattern of communication changes in accordance with the state of a control system. A normal pattern of communication between devices is stored for each state, information indicating the system state is acquired to determine the system state, and information indicating the pattern of communication between devices is acquired to determine the pattern of communication. Then, by determining, on the basis of the determined pattern of communication and the pattern of communication stored as a normal pattern of communication in the determined system state, whether system abnormality has occurred, it is possible to enhance the availability and reliability of the control network.

First claim

The invention claimed is:

1. An information controller of a power plant comprising:
a database configured to store a normal pattern of communication between two devices of a plurality of devices of the power plant for each mode state of a system of the power plant formed by the plurality of devices of the power plant connected to the information controller via a network;
a communication interface coupled to the network and to a system state acquisition device configured to acquire information indicating the mode state of the system to determine the mode state of the system; and
an abnormality determination device configured to:
acquire information indicating a pattern of communication between two of the plurality of devices,
determine whether or not an abnormality occurs in the system based on the acquired pattern of communication and a pattern of communication stored in the database as a normal pattern of communication in the mode state of the system determined by the system state acquisition unit, and
determine that the abnormality occurs in the system in a case where the normal communication in the database corresponding to the mode state of the system has not been performed entirely within a predetermined time period,
wherein the two devices include a first controller and a second controller connected to the network, and
wherein the communication of the acquired information indicating the pattern of communication is one of the first controller notifying the second controller of a state of a turbine of the power plant and a rotation speed of the turbine, and the second controller notifying the first controller of a state of a boiler of the power plant, a temperature of the boiler, and a pressure value of the boiler.

2. The information controller according to claim 1 ,
wherein the abnormality determination unit determines that the abnormality occurs in the system, in a case where at least a portion of the pattern of communication determined by the pattern of communication determination unit does not match the normal pattern of communication stored in the database.

3. The information controller according to claim 1 ,
wherein the database defines the pattern of communication by a set of a source address and a destination address of the devices.

4. The information controller according to claim 1 , further including a database creation unit configured to automatically create the database.

5. The information controller according to claim 1 ,
wherein the database stores the mode state of the system, the normal pattern of communication between the devices, and an abnormality treatment method in the mode state of the system to correspond to one another.

6. An information control system of a power plant comprising:
a plurality of devices configured to communicate with each other;
a connector configured to connect the devices to each other; and
an abnormality determination device configured to:
store a normal pattern of communication between two devices of the plurality of devices for each mode state of the system formed by the plurality of the devices connecting to the network,
acquire information indicating the mode state of the system to determine the mode state of the system,
acquire information indicating a pattern of communication between two of the plurality of devices to determine the pattern of communication,
determine whether or not an abnormality occurs in the system based on the determined pattern of communication and the pattern of communication stored as a normal pattern of communication in the determined mode state of the system, and
determine that the abnormality occurs in the system in a case where the normal communication in the stored pattern of communication corresponding to the mode state of the system has not been performed entirely within a predetermined time period,
wherein the two devices include a first controller and a second controller connected to the network, and
wherein the communication of the acquired information indicating the pattern of communication is one of the first controller notifying the second controller of a state of a turbine of the power plant and a rotation speed of the turbine, and the second controller notifying the first controller of a state of a boiler of the power plant, a temperature of the boiler, and a pressure value of the boiler.

7. The information control system according to claim 6 ,
wherein the abnormality determination device determines that an abnormality occurs in the system, in a case where at least a portion of the determined pattern of communication does not match the stored normal pattern of communication.

8. The information control system according to claim 6 ,
wherein the abnormality determination device defines the pattern of communication by a set of a source address and a destination address of the devices.

9. The information control system according to claim 6 ,
wherein the abnormality determination device stores the mode state of the system, the normal pattern of communication between the devices, and an abnormality treatment method in the mode state of the system to correspond to one another.

10. An information control method of controlling a power plant comprising:
storing a normal pattern of communication between two devices of a plurality of devices of the power plant for each mode state of a system of the power plant formed by the plurality of devices connected to a network;
acquiring information indicating the mode state of the system to determine the mode state of the system;
acquiring information indicating a pattern of communication between two of the plurality of the devices; and
determining whether or not an abnormality occurs in the system based on the acquired determined pattern of communication and the pattern of communication stored as a normal pattern of communication in the determined mode state of the system, and determining that the abnormality occurs in the system in a case where the normal communication in the stored pattern of communication corresponding to the mode state of the system has not been performed entirely within a predetermined time period,
wherein the two devices include a first controller and a second controller connected to the network, and
wherein the communication of the acquired information indicating the pattern of communication is one of the first controller notifying the second controller of a state of a turbine of the power plant and a rotation speed of the turbine, and the second controller notifying the first controller of a state of a boiler of the power plant, a temperature of the boiler, and a pressure value of the boiler.

Assignees

• Hitachi Ltd

Inventors

• Yunoki Shoji
• Yamada Tsutomu

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L29/14

  Electricity · mapped topic

• G05B23/0235 Primary

  based on a comparison with predetermined threshold or range, e.g. "classical methods", carried out during normal operation; threshold adaptation or choice; when or how to compare with the threshold · CPC title

• H04L69/40

  for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) · CPC title

• Y04S40/20

  Information technology specific aspects, e.g. CAD, simulation, modelling, system security · CPC title